Privacy Policy - Saugoti
1) Who we are
Saugoti is provided by Saifullah Ahad (“we”, “us”, “our”).
2) What Saugoti does
Saugoti lets an owner encrypt selected recovery material on a phone and divide the vault key into protected fragments held by nearby guardians. A chosen threshold of matching fragments can restore the encrypted snapshot after phone loss.
3) Information kept only on participating phones
- The owner name, encrypted notes, recovery codes, authenticator seeds, and document images the owner chooses to add.
- The encrypted vault snapshot and the guardian list.
- On each guardian phone: the owner name, guardian name, one key fragment, encrypted snapshot, revision, and integrity hash.
- A local profile name, PIN-protected key envelope, Android Keystore wrapper, and app settings.
Vault content and guardian fragments are encrypted at rest. They are transferred directly between nearby phones during an action started by the user. We do not upload vault content, PINs, document images, recovery codes, authenticator seeds, or key fragments to our service.
4) Limited ceremony metadata processed by our service
To record reachability and help reject replayed or expired recovery attempts, our service processes signed technical metadata: a pseudonymous device identifier derived from a public signing key, the public key, a hash of the recovery-net identifier, a random ceremony identifier, event type (such as start, approval, refusal, completion, timeout, or heartbeat), timestamps, a random nonce, and a cryptographic signature.
This metadata does not include vault content, a guardian fragment, a PIN, an owner or guardian name, contacts, a document, or precise location. It is used only for ceremony integrity, replay prevention, short-lived status, abuse prevention, and service reliability.
5) Retention
Ceremony records expire automatically shortly after the ceremony expiry and never later than 24 hours after processing. Replay-prevention nonces expire after approximately 15 minutes. Local encrypted data remains until the user removes an item, clears Saugoti storage, or uninstalls the app.
6) Permissions
BLUETOOTH_SCAN,BLUETOOTH_ADVERTISE,BLUETOOTH_CONNECT, nearby Wi-Fi, and legacy location on older Android versions: used only while nearby phones enrol, repair, or recover.CAMERA: used only when the owner chooses to photograph a document for the encrypted vault.INTERNETand network state: used only for signed ceremony and guardian-health metadata.
The camera does not run in the background. Permission can be denied or revoked in Android Settings.
7) Service providers and sharing
Cloudflare Workers and Cloudflare KV process the limited service metadata described above. Google Play services provides the Nearby Connections transport between phones. While phones discover and connect, the Nearby SDK in Google Play services collects usage analytics for Google: discovery and connection latency, reliability and throughput, together with the device model, country, Android build version and Saugoti's package name. You can allow or deny this in Settings > Google > Usage & diagnostics (see Google's Nearby Connections overview). These providers may process technical network or diagnostic information under their own terms. We do not sell personal data. Apart from the Nearby usage analytics above, Saugoti uses no advertising, analytics, profiling, or third-party tracking SDKs.
We may disclose limited information if legally required or to protect users and the service. We do not share vault content because the service never receives it.
8) Security and limitations
Saugoti uses AES-GCM authenticated encryption, a PIN-derived local key envelope, Android Keystore protection, cryptographic integrity checks, signed service events, time limits, and threshold secret sharing. No security system is absolute. Saugoti cannot protect information after a user reveals it, a sufficiently compromised or modified device, coercion of enough guardians, or loss of too many current fragments.
9) Your choices
- Choose what to add and which people become guardians.
- Refuse any guardian request or stop a nearby connection when codes do not match.
- Remove vault items or refresh guardian fragments.
- Revoke camera or nearby permissions in Android Settings.
- Clear app storage or uninstall Saugoti to remove local data.
For a privacy question or request about the short-lived service metadata, email [email protected].
10) International processing
Cloudflare may process limited technical metadata in countries outside the user’s country. We apply the same safeguards described in this policy regardless of processing location.
11) Children’s privacy
Saugoti is a general-audience utility and is not directed to children under 13. We do not knowingly collect personal information from children. A parent or guardian may contact us if they believe a child supplied information to the service.
12) Changes
We may update this policy as Saugoti changes. The current version will remain available at https://privacy.saifullah.ai/saugoti.html with its effective date.
13) Contact
Saifullah Ahad
[email protected]
https://saifullah.ai
Dhaka, Bangladesh